> Source: [sk181608](https://support.checkpoint.com/results/sk/sk181608)

# sk181608 - The CloudGuard Controller fails to update Data Center Objects on the R80.30 and below Security Gateways

| Property | Value |
|----------|-------|
| Solution ID | sk181608 |
| Date Created | 2023-11-02 |
| Last Modified | 2024-08-29 |
| Technical Level | Advanced |
| Products | Cloud Firewall |
| Versions | R81 (EOS), R81.10 (EOS), R81.20 |

## Symptoms

- * Security Rules based on Data Center Objects are not enforced on R80.30 and below Security Gateways.
* This error is output to the `$MDS_FWDIR/log/cloud_proxy.elg` file:  

  `
  ERROR datacenter.util.CommandExec [gateway-updater_****]: Failed to execute '[/opt/CPshrd-R81.10/bin/cprid_util, -server, ****, -timeout, 120, -stdout, /etc/fw/tmp/****_vsecUpdate.sh.stdout, -verbose, rexec, -rcmd, /bin/bash, /etc/fw/tmp/****_vsecUpdate.sh, ****, `]' failed with exit code: 255
* This error is output to the `$MDS_FWDIR/log/cloud_proxy.elg` file:  

  `
  ERROR datacenter.util.CommandExec [gateway-updater_***]: command: [/opt/CPshrd-R81.20/bin/cprid_util, -server, ***, -timeout, 120, -stdout, /etc/fw/tmp/****_vsecUpdate.sh.stdout, -verbose, rexec, -rcmd, /bin/bash, /etc/fw/tmp/***_vsecUpdate.sh, ***, ] failed with code '255' and response { "http_code" : 000, "raw_response": }
  `

## Cause

* The CloudGuard Controller configuration has a parameter called `maxRequestSizeInBytes`.

* This parameter sets the maximum number of bytes for one update to a Security Gateway.

* When the CloudGuard Controller must update a Security Gateway with more objects than can fit in the `maxRequestSizeInBytes` limit, it divides the update into smaller parts.

* The CloudGuard Controller increases the default value of this parameter through JHF updates. This reduces the time for Data Center Object propagation to Security Gateways.

* From the Jumbo Hotfix Takes listed below, the default value for the `maxUpdateSizeInBytes` parameter increased to 140KB:

|------------------------------------|-------------------|
| Security Management Server version | Jumbo Hotfix Take |
| R80.40                             | 198               |
| R81                                | 87                |
| R81.10                             | 106               |
| R81.20                             | 24                |

However, R80.30 and older Security Gateways have a maximum request size of 65KB.  
This causes Data Center Objects updates to the Security Gateway to fail.

### How to Verify the Root Cause

If you see only symptom #1 and/or #2, do these steps to check if this issue causes the symptoms:

1. Use SSH or console to connect to the affected Security Gateway.

2. Make a copy of the update script:  
   `cp /etc/fw/tmp/<GW_NAME>_vsecUpdate.sh /etc/fw/tmp/<GW_NAME>_vsecUpdate_backup.sh`

3. Give execution permissions to the script:  
   `chmod +x /etc/fw/tmp/<GW_NAME>_vsecUpdate_backup.sh`

4. Run the script with these parameters:  
   `/etc/fw/tmp/<GW_NAME>_vsecUpdate_backup.sh <GW_NAME> <SHARED_SECRET>`  
   (`SHARED_SECRET` is the secret used to set up the Identity Awareness API on the Security Gateway.)

5. Check if you see this response in the script's output:  
   `{ "http_code" : 000, "raw_response": }`

<br />

If you see symptom #3, you do not need to do more steps to verify the issue.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content